...By signing a binary, you can add information about the publisher and make sure the signed file can be reliably validated after it has been signed. You can use the signtool.exe tool from the .NET Framework SDK to sign .exe and .dll files. Afterwards, you can verify the signature and view the certificate using the properties dialog in Windows Explorer. Note that if both Authenticode and strong name signatures are going to be used, the strong name signature needs to be applied first. Additionally, Authenticode signed assemblies can experience delays at load time, which translates to a longer application startup time if it's the entry point executable that's been signed.
Signed files can also be used for security policies. Using software restriction policies, you can restrict execution of unmanaged executables based on signatures or the absence of signatures (see microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx). And the .NET Framework code access security (CAS) policy supports code groups based on a publisher certificate.
To create a CAS policy, you use mscorcfg.msc to create a new code group based on a publisher membership condition. You can then assign a permission set to all applications signed by that publisher
Comment